# CVE-2026-57709: WP Swings Membership For WooCommerce path traversal arbitrary file deletion

Source: https://junglewise.ai/threats/cve-2026-57709-wp-swings-membership-for-woocommerce-path-traversal-arbitrary  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-13. Updated: 2026-07-13  
License: CC BY 4.0 with a link back

CVE-2026-57709 · Severity: high · CVSS 8.6 · Published 2026-07-13

WP Swings Membership For WooCommerce, a WordPress plugin used to manage membership programs on e-commerce sites, contains a security flaw that allows for unauthorized file manipulation. An attacker can exploit this to delete critical system files, potentially leading to a complete website shutdown or service disruption. This could result in significant downtime and loss of revenue for online stores relying on this plugin.

Vendors: [WP Swings](https://junglewise.ai/threats/vendors/wp-swings).

## Quick answers

**Is CVE-2026-57709 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-57709 being exploited in the wild.

**How severe is CVE-2026-57709?** High severity, with a CVSS score of 8.6, published 13 July 2026.

**Which products and versions are affected?** WP Swings Membership For WooCommerce <= 3.1.0.

**Is there a fix for CVE-2026-57709?** A patch was published on 3.1.1: First unaffected version reported by CNA Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-57709 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-57709?** Check whether you run WP Swings Membership For WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A path traversal vulnerability (CWE-22) exists in the WP Swings Membership For WooCommerce plugin through version 3.1.0. The flaw allows an unauthenticated remote attacker to bypass directory restrictions by providing specially crafted input containing traversal sequences (e.g., ../). According to the CVSS vector and associated references, this specific path traversal leads to arbitrary file deletion. Successful exploitation allows an attacker to delete sensitive files on the server, resulting in a high impact on system availability (DoS). The issue is addressed in version 3.1.1.

## Affected products

- WP Swings Membership For WooCommerce <= 3.1.0

## Timeline

- 2026-07-13: advisory: NVD publication date
- 3.1.1: patched: First unaffected version reported by CNA

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/Wordpress/Plugin/membership-for-woocommerce/vulnerability/wordpress-membership-for-woocommerce-plugin-3-1-0-arbitrary-file-deletion-vulnerability?_s_id=cve](https://patchstack.com/database/Wordpress/Plugin/membership-for-woocommerce/vulnerability/wordpress-membership-for-woocommerce-plugin-3-1-0-arbitrary-file-deletion-vulnerability?_s_id=cve)